2. Constraints
The fixed constraints every part of the design works within. Most are recorded as ADRs; this section collects them so a reader sees the boundary conditions in one place.
2.1 The constitution (binding)
The four rules of ADR-0001 are the top constraint and cannot be traded away by a feature:
- Verification never reads any strongly-consistent domain on the hot path — the identity core and the Forseti relation store (ADR-0026) alike.
- The core holds only the irreducible — issuance, uniqueness, freshness-critical revocation.
- The tenant is the shard, isolation, and residency boundary.
- Vord consumes Wyrd; it does not alter it.
2.2 Technical constraints
- Rust for all Vord-authored components (ADR-0002); adopted engines (the authorization engine) may be any language behind a trait.
- Spec-first, versioned token and credential formats
(ADR-0003) — the one normative,
"data outlives software" artifact class, with conformance vectors in
specs/. - Consumes Wyrd, never alters it (rule 4): bounded to the mechanical hooks Wyrd reserved (Wyrd ADR-0018 — carryable version-fence, placement-over-subtree, uncapped watch fan-out, metadata-op-rate) and Wyrd's namespace store (Wyrd ADR-0020). Vord owns its own tenancy model (ADR-0012) and consumes only those hooks, not Wyrd's storage-tenancy semantics — Wyrd ADR-0022 is a sibling model, not a dependency.
2.3 External-standard constraints
- The external surface conforms; it does not innovate (ADR-0003): OIDC/OAuth2, SAML 2.0, and SCIM 2.0 are specified by others, and Vord speaks them as written so relying parties and IdPs interoperate with stock implementations. A public conformance story is a credibility requirement (ADR-0025). The full catalogue of the standards Vord adopts — and the ADR that adopts each — is section 11.